Which of the following is a recommended practice for securing API keys in IBM Cloud?

Question

Options

• AStore API keys in source code repositories for easy access
• BEmbed API keys directly into client-side code
• CUse IBM Cloud Key Protect to securely manage API keys
• DShare API keys over email with team members for convenience

• A
  8% (3)
• B
  5% (2)
• C
  84% (32)
• D
  3% (1)

Explanation

IBM Cloud Key Protect is a dedicated secrets management service that encrypts, stores, and controls access to API keys using hardware security modules (HSMs), making it the recommended approach for securing sensitive credentials in IBM Cloud environments.

Why the distractors are wrong:

• A - Storing API keys in source code repositories (even private ones) is a critical security vulnerability; keys can be accidentally exposed via git history, forks, or public leaks.
• B - Client-side code is readable by anyone with browser dev tools, meaning embedded keys are immediately compromised and publicly exposed.
• D - Email is unencrypted and persistent, creating audit trail violations and making keys difficult to rotate or revoke if compromised.

Memory tip: Think of Key Protect as a "vault with a guard" - the key never travels unprotected, and access is logged and controlled. Contrast this with options A, B, and D, which all involve keys traveling in the open (repos, browsers, email). If the key is visible, it's vulnerable.

No community discussion yet for this question.